gitlab: 12.6.4 -> 12.7.4

- CVE-2020-7966
 - CVE-2020-8114
 - CVE-2020-7973
 - CVE-2020-6833
 - CVE-2020-7971
 - CVE-2020-7967
 - CVE-2020-7972
 - CVE-2020-7968
 - CVE-2020-7979
 - CVE-2020-7969
 - CVE-2020-7978
 - CVE-2020-7974
 - CVE-2020-7977
 - CVE-2020-7976
 - CVE-2019-16779
 - CVE-2019-18978
 - CVE-2019-16892
This commit is contained in:
Florian Klink
2020-01-31 12:34:57 +01:00
parent 968f7c2890
commit cb02372211
5 changed files with 415 additions and 300 deletions
@@ -55,8 +55,8 @@ GEM
adamantium (0.2.0)
ice_nine (~> 0.11.0)
memoizable (~> 0.4.0)
addressable (2.5.2)
public_suffix (>= 2.0.2, < 4.0)
addressable (2.7.0)
public_suffix (>= 2.0.2, < 5.0)
aes_key_wrap (1.0.1)
akismet (3.0.0)
apollo_upload_server (2.0.0.beta.3)
@@ -71,7 +71,7 @@ GEM
asciidoctor (2.0.10)
asciidoctor-include-ext (0.3.1)
asciidoctor (>= 1.5.6, < 3.0.0)
asciidoctor-plantuml (0.0.9)
asciidoctor-plantuml (0.0.10)
asciidoctor (>= 1.5.6, < 3.0.0)
ast (2.4.0)
atlassian-jwt (0.2.0)
@@ -81,13 +81,15 @@ GEM
attr_required (1.0.1)
awesome_print (1.8.0)
aws-eventstream (1.0.3)
aws-sdk (2.11.374)
aws-sdk-resources (= 2.11.374)
aws-sdk-core (2.11.374)
aws-sigv4 (~> 1.0)
aws-partitions (1.263.0)
aws-sdk-cloudformation (1.29.0)
aws-sdk-core (~> 3, >= 3.71.0)
aws-sigv4 (~> 1.1)
aws-sdk-core (3.88.0)
aws-eventstream (~> 1.0, >= 1.0.2)
aws-partitions (~> 1, >= 1.239.0)
aws-sigv4 (~> 1.1)
jmespath (~> 1.0)
aws-sdk-resources (2.11.374)
aws-sdk-core (= 2.11.374)
aws-sigv4 (1.1.0)
aws-eventstream (~> 1.0, >= 1.0.2)
axiom-types (0.1.1)
@@ -117,7 +119,7 @@ GEM
activemodel (>= 5.0)
brakeman (4.2.1)
browser (2.5.3)
builder (3.2.3)
builder (3.2.4)
bullet (6.0.2)
activesupport (>= 3.0.0)
uniform_notifier (~> 1.11)
@@ -192,7 +194,7 @@ GEM
database_cleaner (1.7.0)
debug_inspector (0.0.3)
debugger-ruby_core_source (1.3.8)
deckar01-task_list (2.2.1)
deckar01-task_list (2.3.1)
html-pipeline
declarative (0.0.10)
declarative-option (0.1.0)
@@ -235,17 +237,17 @@ GEM
doorkeeper (~> 4.3)
json-jwt (~> 1.6)
ed25519 (1.2.4)
elasticsearch (5.0.3)
elasticsearch-api (= 5.0.3)
elasticsearch-transport (= 5.0.3)
elasticsearch-api (5.0.3)
elasticsearch (6.8.0)
elasticsearch-api (= 6.8.0)
elasticsearch-transport (= 6.8.0)
elasticsearch-api (6.8.0)
multi_json
elasticsearch-model (0.1.9)
elasticsearch-model (6.1.0)
activesupport (> 3)
elasticsearch (> 0.4)
elasticsearch (> 1)
hashie
elasticsearch-rails (0.1.9)
elasticsearch-transport (5.0.3)
elasticsearch-rails (6.1.0)
elasticsearch-transport (6.8.0)
faraday
multi_json
email_reply_trimmer (0.1.6)
@@ -260,7 +262,7 @@ GEM
et-orbi (1.2.1)
tzinfo
eventmachine (1.2.7)
excon (0.62.0)
excon (0.71.1)
execjs (2.6.0)
expression_parser (0.9.0)
extended-markdown-filter (0.6.0)
@@ -270,15 +272,15 @@ GEM
factory_bot_rails (5.1.0)
factory_bot (~> 5.1.0)
railties (>= 4.2.0)
faraday (0.12.2)
faraday (0.15.4)
multipart-post (>= 1.2, < 3)
faraday-http-cache (2.0.0)
faraday (~> 0.8)
faraday_middleware (0.12.2)
faraday (>= 0.7.4, < 1.0)
faraday_middleware-aws-signers-v4 (0.1.7)
aws-sdk-resources (~> 2)
faraday (~> 0.9)
faraday_middleware-aws-sigv4 (0.3.0)
aws-sigv4 (~> 1.0)
faraday (>= 0.15)
faraday_middleware-multi_json (0.0.6)
faraday_middleware
multi_json
@@ -286,6 +288,9 @@ GEM
fast_gettext (1.6.0)
ffaker (2.10.0)
ffi (1.11.3)
ffi-compiler (1.0.1)
ffi (>= 1.0.0)
rake
flipper (0.17.1)
flipper-active_record (0.17.1)
activerecord (>= 4.2, < 7)
@@ -357,12 +362,12 @@ GEM
po_to_json (>= 1.0.0)
rails (>= 3.2.0)
git (1.5.0)
gitaly (1.73.0)
gitaly (1.81.0)
grpc (~> 1.0)
github-markup (1.7.0)
gitlab-chronic (0.10.5)
numerizer (~> 0.2)
gitlab-labkit (0.7.0)
gitlab-labkit (0.8.0)
actionpack (>= 5.0.0, < 6.1.0)
activesupport (>= 5.0.0, < 6.1.0)
grpc (~> 1.19)
@@ -379,11 +384,12 @@ GEM
gitlab-puma (>= 2.7, < 5)
gitlab-sidekiq-fetcher (0.5.2)
sidekiq (~> 5)
gitlab-styles (2.8.0)
rubocop (~> 0.69.0)
gitlab-styles (3.1.0)
rubocop (~> 0.74.0)
rubocop-gitlab-security (~> 0.1.0)
rubocop-performance (~> 1.1.0)
rubocop-rspec (~> 1.19)
rubocop-performance (~> 1.4.1)
rubocop-rails (~> 2.0)
rubocop-rspec (~> 1.36)
gitlab_chronic_duration (0.10.6.2)
numerizer (~> 0.2)
gitlab_omniauth-ldap (2.1.1)
@@ -426,7 +432,7 @@ GEM
grape-entity (0.7.1)
activesupport (>= 4.0)
multi_json (>= 1.3.2)
grape-path-helpers (1.1.0)
grape-path-helpers (1.2.0)
activesupport
grape (~> 1.0)
rake (~> 12)
@@ -477,7 +483,7 @@ GEM
tilt
hangouts-chat (0.0.5)
hashdiff (0.3.8)
hashie (3.5.7)
hashie (3.6.0)
hashie-forbidden_attributes (0.1.1)
hashie (>= 3.0)
health_check (2.6.0)
@@ -492,20 +498,21 @@ GEM
html2text (0.2.0)
nokogiri (~> 1.6)
htmlentities (4.3.4)
http (3.3.0)
http (4.2.0)
addressable (~> 2.3)
http-cookie (~> 1.0)
http-form_data (~> 2.0)
http_parser.rb (~> 0.6.0)
http-parser (~> 1.2.0)
http-cookie (1.0.3)
domain_name (~> 0.5)
http-form_data (2.1.1)
http_parser.rb (0.6.0)
http-parser (1.2.1)
ffi-compiler (>= 1.0, < 2.0)
httparty (0.16.4)
mime-types (~> 3.0)
multi_xml (>= 0.5.2)
httpclient (2.8.3)
i18n (1.7.0)
i18n (1.7.1)
concurrent-ruby (~> 1.0)
i18n_data (0.8.0)
icalendar (2.4.1)
@@ -519,7 +526,7 @@ GEM
jaeger-client (0.10.0)
opentracing (~> 0.3)
thrift
jaro_winkler (1.5.3)
jaro_winkler (1.5.4)
jira-ruby (1.7.1)
activesupport
atlassian-jwt
@@ -556,8 +563,8 @@ GEM
kramdown (2.1.0)
kramdown-parser-gfm (1.1.0)
kramdown (~> 2.0)
kubeclient (4.4.0)
http (~> 3.0)
kubeclient (4.6.0)
http (>= 3.0, < 5.0)
recursive-open-struct (~> 1.0, >= 1.0.4)
rest-client (~> 2.0)
launchy (2.4.3)
@@ -577,6 +584,7 @@ GEM
xml-simple
licensee (8.9.2)
rugged (~> 0.24)
liquid (4.0.3)
listen (3.1.5)
rb-fsevent (~> 0.9, >= 0.9.4)
rb-inotify (~> 0.9, >= 0.9.7)
@@ -587,9 +595,10 @@ GEM
activesupport (>= 4)
railties (>= 4)
request_store (~> 1.0)
loofah (2.3.1)
loofah (2.4.0)
crass (~> 1.0.2)
nokogiri (>= 1.5.9)
lru_redux (1.1.0)
lumberjack (1.0.13)
mail (2.7.1)
mini_mime (>= 0.1.1)
@@ -613,9 +622,9 @@ GEM
mini_portile2 (2.4.0)
minitest (5.11.3)
msgpack (1.3.1)
multi_json (1.13.1)
multi_json (1.14.1)
multi_xml (0.6.0)
multipart-post (2.0.0)
multipart-post (2.1.1)
murmurhash3 (0.1.6)
mustermann (1.0.3)
mustermann-grape (1.0.0)
@@ -623,13 +632,13 @@ GEM
nakayoshi_fork (0.0.4)
nap (1.1.0)
nenv (0.3.0)
net-ldap (0.16.0)
net-ldap (0.16.2)
net-ntp (2.1.3)
net-ssh (5.2.0)
netrc (0.11.0)
nio4r (2.5.2)
no_proxy_fix (0.1.2)
nokogiri (1.10.5)
nokogiri (1.10.7)
mini_portile2 (~> 2.4.0)
nokogumbo (1.5.0)
nokogiri
@@ -644,7 +653,8 @@ GEM
multi_json (~> 1.3)
multi_xml (~> 0.5)
rack (>= 1.2, < 3)
octokit (4.9.0)
octokit (4.15.0)
faraday (>= 0.9)
sawyer (~> 0.8.0, >= 0.5.3)
omniauth (1.9.0)
hashie (>= 3.4.6, < 3.7.0)
@@ -725,13 +735,14 @@ GEM
rubypants (~> 0.2)
orm_adapter (0.5.0)
os (1.0.0)
parallel (1.17.0)
parser (2.6.3.0)
parallel (1.19.1)
parser (2.6.5.0)
ast (~> 2.4.0)
parslet (1.8.2)
peek (1.1.0)
railties (>= 4.0.0)
pg (1.1.4)
png_quantizator (0.2.1)
po_to_json (1.0.1)
json (>= 1.6.0)
premailer (1.11.1)
@@ -755,7 +766,7 @@ GEM
pry (~> 0.10)
pry-rails (0.3.6)
pry (>= 0.10.4)
public_suffix (3.1.1)
public_suffix (4.0.3)
pyu-ruby-sasl (0.0.3.3)
raabro (1.1.6)
rack (2.0.7)
@@ -763,7 +774,8 @@ GEM
rack (>= 0.4)
rack-attack (6.2.0)
rack (>= 1.0, < 3)
rack-cors (1.0.2)
rack-cors (1.0.6)
rack (>= 1.6.0)
rack-oauth2 (1.9.3)
activesupport
attr_required
@@ -820,7 +832,7 @@ GEM
ffi (>= 1.0.6)
msgpack (>= 0.4.3)
optimist (>= 3.0.0)
rdoc (6.0.4)
rdoc (6.1.2)
re2 (1.1.1)
recaptcha (4.13.1)
json
@@ -903,7 +915,7 @@ GEM
pg
rails
sqlite3
rubocop (0.69.0)
rubocop (0.74.0)
jaro_winkler (~> 1.5.1)
parallel (~> 1.10)
parser (>= 2.6)
@@ -912,10 +924,13 @@ GEM
unicode-display_width (>= 1.4.0, < 1.7)
rubocop-gitlab-security (0.1.1)
rubocop (>= 0.51)
rubocop-performance (1.1.0)
rubocop (>= 0.67.0)
rubocop-rspec (1.22.2)
rubocop (>= 0.52.1)
rubocop-performance (1.4.1)
rubocop (>= 0.71.0)
rubocop-rails (2.4.0)
rack (>= 1.1)
rubocop (>= 0.72.0)
rubocop-rspec (1.37.0)
rubocop (>= 0.68.1)
ruby-enum (0.7.2)
i18n
ruby-fogbugz (0.2.1)
@@ -929,7 +944,7 @@ GEM
sexp_processor (~> 4.9)
rubyntlm (0.6.2)
rubypants (0.2.0)
rubyzip (1.3.0)
rubyzip (2.0.0)
rugged (0.28.4.1)
safe_yaml (1.0.4)
sanitize (4.6.6)
@@ -950,9 +965,9 @@ GEM
sprockets (> 3.0)
sprockets-rails
tilt
sawyer (0.8.1)
addressable (>= 2.3.5, < 2.6)
faraday (~> 0.8, < 1.0)
sawyer (0.8.2)
addressable (>= 2.3.5)
faraday (> 0.8, < 2.0)
scss_lint (0.56.0)
rake (>= 0.9, < 13)
sass (~> 3.5.3)
@@ -1042,7 +1057,7 @@ GEM
truncato (0.7.11)
htmlentities (~> 4.3.1)
nokogiri (>= 1.7.0, <= 2.0)
tzinfo (1.2.5)
tzinfo (1.2.6)
thread_safe (~> 0.1)
u2f (0.2.1)
uber (0.1.0)
@@ -1119,17 +1134,18 @@ DEPENDENCIES
acme-client (~> 2.0.2)
activerecord-explain-analyze (~> 0.1)
acts-as-taggable-on (~> 6.0)
addressable (~> 2.5.2)
addressable (~> 2.7)
akismet (~> 3.0)
apollo_upload_server (~> 2.0.0.beta3)
asana (~> 0.9)
asciidoctor (~> 2.0.10)
asciidoctor-include-ext (~> 0.3.1)
asciidoctor-plantuml (= 0.0.9)
asciidoctor-plantuml (= 0.0.10)
atlassian-jwt (~> 0.2.0)
attr_encrypted (~> 3.1.0)
awesome_print
aws-sdk
aws-sdk-cloudformation (~> 1)
aws-sdk-core (~> 3)
babosa (~> 1.0.2)
base32 (~> 0.3.0)
batch-loader (~> 1.4.0)
@@ -1155,7 +1171,7 @@ DEPENDENCIES
creole (~> 0.5.0)
danger (~> 6.0)
database_cleaner (~> 1.7.0)
deckar01-task_list (= 2.2.1)
deckar01-task_list (= 2.3.1)
default_value_for (~> 3.3.0)
derailed_benchmarks
device_detector
@@ -1167,15 +1183,15 @@ DEPENDENCIES
doorkeeper (~> 4.3)
doorkeeper-openid_connect (~> 1.5)
ed25519 (~> 1.2)
elasticsearch-api (= 5.0.3)
elasticsearch-model (~> 0.1.9)
elasticsearch-rails (~> 0.1.9)
elasticsearch-api (~> 6.8)
elasticsearch-model (~> 6.1)
elasticsearch-rails (~> 6.1)
email_reply_trimmer (~> 0.1)
email_spec (~> 2.2.0)
escape_utils (~> 1.1)
factory_bot_rails (~> 5.1.0)
faraday (~> 0.12)
faraday_middleware-aws-signers-v4
faraday_middleware-aws-sigv4
fast_blank
ffaker (~> 2.10)
flipper (~> 0.17.1)
@@ -1196,17 +1212,17 @@ DEPENDENCIES
gettext (~> 3.2.2)
gettext_i18n_rails (~> 1.8.0)
gettext_i18n_rails_js (~> 1.3)
gitaly (~> 1.73.0)
gitaly (~> 1.81.0)
github-markup (~> 1.7.0)
gitlab-chronic (~> 0.10.5)
gitlab-labkit (~> 0.5)
gitlab-labkit (= 0.8.0)
gitlab-license (~> 1.0)
gitlab-markup (~> 1.7.0)
gitlab-net-dns (~> 0.9.1)
gitlab-puma (~> 4.3.1.gitlab.2)
gitlab-puma_worker_killer (~> 0.1.1.gitlab.1)
gitlab-sidekiq-fetcher (= 0.5.2)
gitlab-styles (~> 2.7)
gitlab-styles (~> 3.1.0)
gitlab_chronic_duration (~> 0.10.6.2)
gitlab_omniauth-ldap (~> 2.1.1)
gon (~> 6.2)
@@ -1215,7 +1231,7 @@ DEPENDENCIES
gpgme (~> 2.0.19)
grape (~> 1.1.0)
grape-entity (~> 0.7.1)
grape-path-helpers (~> 1.1)
grape-path-helpers (~> 1.2)
grape_logging (~> 1.7)
graphiql-rails (~> 1.4.10)
graphql (~> 1.9.11)
@@ -1241,12 +1257,14 @@ DEPENDENCIES
jwt (~> 2.1.0)
kaminari (~> 1.0)
knapsack (~> 1.17)
kubeclient (~> 4.4.0)
kubeclient (~> 4.6.0)
letter_opener_web (~> 1.3.4)
license_finder (~> 5.4)
licensee (~> 8.9)
liquid (~> 4.0)
lograge (~> 0.5)
loofah (~> 2.2)
lru_redux
mail_room (~> 0.10.0)
marginalia (~> 1.8.0)
memory_profiler (~> 0.9)
@@ -1260,7 +1278,7 @@ DEPENDENCIES
net-ssh (~> 5.2)
nokogiri (~> 1.10.5)
oauth2 (~> 1.4)
octokit (~> 4.9)
octokit (~> 4.15)
omniauth (~> 1.8)
omniauth-auth0 (~> 2.0.0)
omniauth-authentiq (~> 0.3.3)
@@ -1280,8 +1298,10 @@ DEPENDENCIES
omniauth_crowd (~> 2.2.0)
omniauth_openid_connect (~> 0.3.3)
org-ruby (~> 0.9.12)
parallel (~> 1.19)
peek (~> 1.1)
pg (~> 1.1)
png_quantizator (~> 0.2.1)
premailer-rails (~> 1.10.3)
prometheus-client-mmap (~> 0.10.0)
pry-byebug (~> 3.5.1)
@@ -1299,7 +1319,7 @@ DEPENDENCIES
raindrops (~> 0.18)
rblineprof (~> 0.3.6)
rbtrace (~> 0.4)
rdoc (~> 6.0)
rdoc (~> 6.1.2)
re2 (~> 1.1.1)
recaptcha (~> 4.11)
redis (~> 4.0)
@@ -1316,14 +1336,14 @@ DEPENDENCIES
rspec-set (~> 0.1.3)
rspec_junit_formatter
rspec_profiling (~> 0.0.5)
rubocop (~> 0.69.0)
rubocop-performance (~> 1.1.0)
rubocop-rspec (~> 1.22.1)
rubocop (~> 0.74.0)
rubocop-performance (~> 1.4.1)
rubocop-rspec (~> 1.37.0)
ruby-fogbugz (~> 0.2.1)
ruby-prof (~> 1.0.0)
ruby-progressbar
ruby_parser (~> 3.8)
rubyzip (~> 1.3.0)
rubyzip (~> 2.0.0)
rugged (~> 0.28)
sanitize (~> 4.6)
sassc-rails (~> 2.1.0)